March 2026 - Koha-bugs - lists.koha-community.org

[Bug 36192] New: [OMNIBUS] CSRF Protection for Koha
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 Bug ID: 36192 Summary: [OMNIBUS] CSRF Protection for Koha Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: critical Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs(a)lists.koha-community.org Reporter: nick(a)bywatersolutions.com QA Contact: testopia(a)bugs.koha-community.org Bug 34478 will be pushed soon, this bug will be for tracking remaining work with dependencies etc, more info to follow -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 156

[Bug 36416] New: Check out using CirculateILL is broken
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36416 Bug ID: 36416 Summary: Check out using CirculateILL is broken Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com CC: david(a)davidnind.com, katrin.fischer(a)bsz-bw.de, martin.renvoize(a)ptfs-europe.com, pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Blocks: 36192 To reproduce: 1) Install FreeForm and enable ILLModule, run: bash <(curl -s https://raw.githubusercontent.com/ammopt/koha-ill-dev/master/start-ill-dev.…) 2) Checkout to branch b_36243 cd /kohadevbox/koha/Koha/Illbackends/FreeForm git checkout b_36243 3) Enable CirculateILL sys pref 4) Create a new ILL request, visit: <staff_url>/cgi-bin/koha/ill/ill-requests.pl?method=create&backend=FreeForm 5) Set "type" = Book and enter '42' on the cardnumber input, click "Create" 6) On the top toolbar, click "Confirm" and confirm the following screen. 7) You now have a new option "Check out" on the toolbar. Click on it. Notice it explodes. Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 14

[Bug 36414] New: Consequent workflow stages form submit fail due to CSRF token conflict
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36414 Bug ID: 36414 Summary: Consequent workflow stages form submit fail due to CSRF token conflict Change sponsored?: --- Product: Koha Version: master Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Blocks: 36192 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=36192 [Bug 36192] [OMNIBUS] CSRF Protection for Koha -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 17

[Bug 41591] XSS vulnerability via file upload function for invoices
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41591 Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs documenting |RESOLVED Resolution|--- |FIXED CC| |caroline.cyr-la-rose@inlibr | |o.com --- Comment #12 from Caroline Cyr La Rose <caroline.cyr-la-rose(a)inlibro.com> --- This is a bug fix, nothing to change in the manual -- You are receiving this mail because: You are watching all bug changes.

1 0

[Bug 37194] New: Improve link from unconfigured ILL module
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37194 Bug ID: 37194 Summary: Improve link from unconfigured ILL module Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: enhancement Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: magnus(a)libriotech.no CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com To reproduce in ktd: - Enable the ILLModule syspref - Go to the ILL module - Observe the link that reads "Take a look at the about page" and points to http://localhost:8081/cgi-bin/koha/about.pl#sysinfo_panel - The link takes you to the "About Koha" page, but it does not show the contents of the "System information" tab, where the relevant information is - Clicking on the "System information" tab changes the page to http://localhost:8081/cgi-bin/koha/about.pl?tab=sysinfo Suggestions: - Change the link text so it reads 'Take a look at "System information" on the "About Koha" page' - Change the actual link from http://localhost:8081/cgi-bin/koha/about.pl#sysinfo_panel to http://localhost:8081/cgi-bin/koha/about.pl?tab=sysinfo -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 13

[Bug 39765] New: ILL - Backends are not working
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39765 Bug ID: 39765 Summary: ILL - Backends are not working Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: major Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)openfifth.co.uk QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)openfifth.co.uk, tomascohen(a)gmail.com Depends on: 38340 This patch: https://bugs.koha-community.org/bugzilla3/page.cgi?id=splinter.html&bug=383… Is adding the method get_plugin but that method is never implemented. prove t/db_dependent/Koha/ILL/Requests.t t/db_dependent/Koha/ILL/Requests.t .. 6/17 # Looks like you planned 13 tests but ran 12. t/db_dependent/Koha/ILL/Requests.t .. 7/17 # Failed test 'Backend testing (mocks)' # at t/db_dependent/Koha/ILL/Requests.t line 808. The method Koha::ILL::Request->get_plugin is not covered by tests! Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38340 [Bug 38340] Translatability - Standard form include files are not translatable -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 26

[Bug 38340] New: Translatability - Standard form include files are not translatable
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38340 Bug ID: 38340 Summary: Translatability - Standard form include files are not translatable Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Depends on: 35570 .inc files may need to be moved to koha-tmpl and opac-tmpl Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35570 [Bug 35570] Add a generic master form in ILL -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.

1 107

[Bug 38339] New: Standard backend _get_core_fields are not translatable
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38339 Bug ID: 38339 Summary: Standard backend _get_core_fields are not translatable Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: koha-bugs(a)lists.koha-community.org Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Depends on: 35570 Following FIXME lines on ILL/Backend/Standard.pm: # FIXME: This should all be made translatable as is basically a # code => description mapping. The metadata() sub is using this # descriptions as keys. I thought this was a bug on this backend # but it turns out opac-illrequests.tt is using those descriptions # as keys. for example: # [% IF request.metadata.Author %][% request.metadata.Author | html %][% ELSE %]... Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=35570 [Bug 35570] Add a generic master form in ILL -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.

1 28

[Bug 39178] New: ILL table does not render when viewing requests of a batch
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39178 Bug ID: 39178 Summary: ILL table does not render when viewing requests of a batch Change sponsored?: --- Product: Koha Version: 24.11 Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: ILL Assignee: pedro.amorim(a)ptfs-europe.com Reporter: pedro.amorim(a)ptfs-europe.com QA Contact: testopia(a)bugs.koha-community.org CC: jeremy.evans(a)ukhsa.gov.uk, katrin.fischer(a)bsz-bw.de, martin.renvoize(a)ptfs-europe.com, pedro.amorim(a)ptfs-europe.com, tomascohen(a)gmail.com Depends on: 38714 To test: 1) Enabled ILLModule 2) Install a metadat enrichment plugin .e.g: https://github.com/PTFS-Europe/koha-plugin-api-pubmed/releases/tag/1.1.1 3) Visit ILL requests: http://localhost:8081/cgi-bin/koha/ill/ill-requests.pl 4) Click 'New ILL requests batch' and pick 'Standard' 5) Enter a name 'test', a cardnumber '42' and any library 6) Click "Continue", enter '123' on the identifiers textarea on the right. 7) Click "Process identifiers" 8) Click "Add items to batch" 9) Click "Finish and view batch" 10) No table is rendered Caused by: https://github.com/Koha-Community/Koha/commit/7219566 Referenced Bugs: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=38714 [Bug 38714] Adjust templates for prettier -- You are receiving this mail because: You are watching all bug changes.

1 14

[Bug 39313] New: OpacTrustedCheckout self-checkout modal not checking out valid barcode
by bugzilla-daemon＠bugs.koha-community.org 27 Mar '26

27 Mar '26

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=39313 Bug ID: 39313 Summary: OpacTrustedCheckout self-checkout modal not checking out valid barcode Change sponsored?: --- Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: blocker Priority: P5 - low Component: OPAC Assignee: oleonard(a)myacpl.org Reporter: aleisha(a)catalyst.net.nz QA Contact: testopia(a)bugs.koha-community.org Entering a valid barcode into the self-checkout modal returns an error "Message code 'UNKNOWN_BARCODE' with data '1'" Requires OpacTrustedCheckout to be enabled -- You are receiving this mail because: You are watching all bug changes.

1 23